Prepared for California State Assembly Judiciary Committee

Author: Lenny Siegel

Presented by: Chris Hibbert

Additional Contributors: Peter Neumann, Jeff Johnson, Paul Czyzewski

January 8, 2002

Executive Summary

Since September 11, vendors of high-technology systems and others
have proposed or dusted off proposals for new or enhanced national
identification schemes. Computer Professionals for Social
Responsibility (CPSR), a public-interest alliance of computer
scientists and others concerned about the impact of computer
technology on society, has reviewed those proposals. We have
concluded that none of the proposed national identification schemes
clearly states which problem it tries to solve and how exactly it
contributes to reducing the danger of terrorism.

Furthermore, we find that national identification schemes can
increase the likelihood of identity theft, enable the spread of
misinformation, undermine personal privacy, misuse limited resources,
and create a false sense of security. While we are reluctant to give
up individual rights to bolster security, we warn that there is no
reason to assume that identification schemes that threaten privacy
will be protective.

California officials, like those in other states, should play a
key role in the evaluation of such proposals, because state-issued
drivers' licenses and identity cards today perform many of the
functions proposed for the new identity schemes. By moving forward
carefully, California can protect its residents from the threats to
both our both physical safety and our Fourth Amendment right to be
secure in our "persons, houses, papers, and effects." We believe the
following three principles should guide the review of proposals for
enhanced identify schemes.

It is essential to consider the functions and objectives of
an identity scheme before considering which technologies are most
appropriate. Proponents of enhanced identification schemes say
they are required to prevent future terrorist attack, but a national
identification scheme would not have prevented the September 11
attacks. The overwhelming majority of the hijackers were in the US
legally and had no record with the FBI or other security agency.
Evidence suggests that they made no effort to conceal their
identities. Several of the hijackers had state-issued ID cards with
their pictures and names. Therefore, simple authentication checks
prior to boarding the plane would have not have revealed anything
that would have aroused the suspicions of authorities.

Building more complex and universal identity schemes
increases the likelihood of deliberate or accidental error and
abuse. Complex schemes serve multiple functions. For example,
drivers' licenses are commonly used as proof-of-age for purchasing
alcoholic beverages. That increases the incentive for developing
means of forging documents that allow unqualified people to drive.
More universal schemes -- those that significantly increase the
number of data records (people) or access points (terminals) -- make
it much more difficult to verify information in the system.

New biometric technologies, most of which digitize personal
physical characteristics, are more appropriate for small,
special-purpose identity schemes than society-wide, general-purpose
ones. That is, proving that someone is who he/she claims to be
enhances security when you have a relatively small number of people
who have approved access to facilities or information because their
backgrounds are known and trusted. It is not as effective if one is
dealing with a global population of millions of people who may or may
not be represented in the database and whose background is not
known.

Conclusions

In conclusion, CPSR believes that information technology can be
used to address problems ranging from foreign-based terrorism to tax
evasion to drunk driving. However, the technology should be tailored
to solve each problem. National and other general-purpose enhanced
identification schemes are unlikely to provide satisfactory
solutions, and are much more likely to facilitate the erosion of our
civil liberties and property rights.